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Abstract 

Gas turbine engines are designed to provide sufficient safety margins to guarantee robust operation 
with an exceptionally long life. However, engine performance requirements may be drastically altered 
during abnormal flight conditions or emergency maneuvers. In some situations, the conservative design of 
the engine control system may not be in the best interest of overall aircraft safety; it may be advantageous 
to “sacrifice” the engine to “save” the aircraft. Motivated by this opportunity, the NASA Aviation Safety 
Program is conducting resilient propulsion research aimed at developing adaptive engine control 
methodologies to operate the engine beyond the normal domain for emergency operations to maximize 
the possibility of safely landing the damaged aircraft. Previous research studies and field incident reports 
show that the propulsion system can be an effective tool to help control and eventually land a damaged 
aircraft. Building upon the flight-proven Propulsion Controlled Aircraft (PCA) experience, this area of 
research will focus on how engine control systems can improve aircraft safe-landing probabilities under 
adverse conditions. This paper describes the proposed research topics in Engine System Requirements, 
Engine Modeling and Simulation, Engine Enhancement Research, Operational Risk Analysis and 
Modeling, and Integrated Flight and Propulsion Controller Designs that support the overall goal. 

I. Introduction 

On July 19, 1989, the center, tail-mounted engine of a United Airlines (UAL) DC- 10 suffered an 
uncontained failure in flight, which resulted in the loss of all hydraulic systems as well as airframe 
damage (ref. 1). Using differential engine thrust alone, the crew was able to fly the crippled aircraft to the 
Sioux City, Iowa airport, where they successfully crash landed it. Although the resulting impact and 
flames claimed many victims, the fact that there were any survivors at all is a testament to the heroic 
actions of the crew, who managed to regain and maintain control of the plane without the use of the flight 
control surfaces. Similar loss-of-hydraulics situations have not had favorable outcomes, and in fact the 
only case of an in-service jet airliner of this type to land safely without any hydraulics has been the recent 
DHL shootdown incident in Baghdad (ref. 2). 

NASA has traditionally made aviation safety one of its major research missions and the Sioux City 
accident, along with the pilots’ recovery strategies, has been influential. Recognizing the importance of 
the role of the propulsion system in the operation of a damaged aircraft, NASA initiated the Propulsion 
Controlled Aircraft (PCA) research effort in the early 1990’s (ref. 3). A PCA system that used pilot- 
supplied flight-path command inputs and airplane sensor feedback parameters to generate appropriate 
engine thrust commands for emergency flight operation was demonstrated successfully. This PCA system 
requires no modification to the engine or engine control system. The Throttles-Only Control (TOC), 
where the pilot maneuvered the airplane using only the throttles, was demonstrated over a wide range of 
commercial and fighter aircraft (ref. 4). These demonstrations pointed out the maneuverability issues 
resulting from slow engine response and the high level of pilot workload required during landing. 
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In response to the potential Man Portable Air Defense System (MANPADS) threat to commercial 
airliners, NASA launched the “Damage Adaptive Control System (DACS)” project in the early 2000’s 
under the Aviation Safety and Security Program. The objective of the DACS project was to find possible 
solutions to maximize the chance for safe landing of partially impaired aircraft. Under DACS, there were 
research projects exploring the possible roles of propulsion to assist the flight control system in safely 
operating a damaged aircraft. One of the projects, “Commercial Engine Damage Assessment and 
Reconfiguration (CEDAR),” investigated how to continue to operate and maintain the necessary thrust of a 
slightly damaged engine under an emergency situation where engine shut down is not an option. This is a 
commercial version of a previous successfully demonstrated Naval Air Systems Command (NAVAIR) 
project “Survivable Engine Control Algorithm Development (SECAD) (ref. 5).” Another project under 
DACS was “Damaged Aircraft Good Engine (DAGE)” where the research focused on the propulsion 
system’s role in aircraft control by re-examining the engine operating envelope and whether a higher 
performing engine can be used to help control and land the damaged aircraft under adverse conditions. 
“Resilient Propulsion Control,” the propulsion element under the “Integrated Resilient Aircraft Control 
(IRAC)” project of the new NASA Aviation Safety Program, is built on the foundations laid by these 
predecessors. In the new re-programming of NASA Aeronautics Research, the IRAC project was proposed 
under the Aviation Safety Program to cover a wide range of aircraft mishaps including the loss of control, 
which is one of the largest contributors to airplane fatalities (ref. 6). The main objective of the IRAC project 
is similar to the DACS project concerning how to control and safely land an aircraft under adverse 
conditions, but the scope of the aircraft damage is extended to cover situations beyond the missile damage 
scenarios of the DACS project. Building upon the previously demonstrated research results such as PCA 
and TOC, the propulsion element under the IRAC project proposes to do research on how to best use the 
propulsion system to assist the flight control system under adverse conditions. This includes temporary 
engine operation enhancement beyond design limits, and exploration of integrated flight and propulsion 
control architectures to include the propulsion system as a redundant actuator for emergency operation. 

This paper will first describe a high level analysis of requirements for the propulsion system in IRAC. 
A process to develop an engine simulation model and its controller are also described. We will then 
discuss the research area on the enhanced engine operations in high thrust and fast response operation. 

The impact on engine life and operability will also be discussed and a probabilistic risk assessment 
system proposed for the high level decision making process. Finally issues of integration with the flight 
control system will be discussed. 

Figure 1 shows the concept for the propulsion system under IRAC. An intelligent propulsion system 
will continuously assess its health condition and remaining capabilities and report the status to the flight 
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Figure 1. — Intelligent propulsion system concept for IRAC. 
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controller. Depending upon the severity of the adverse condition, the integrated flight and propulsion 
control will select the engine operating modes according to the remaining capability of the propulsion 
system and the risk that the flight controller is willing to accept. 

II. System Requirements 

It is important to define a process to understand how and when the propulsion system can be used to 
assist the flight controller in providing a safer option beyond currently available solutions. The process 
requires a system level study to review and evaluate historical scenarios that involve aircraft accidents 
and incidents in which some or all flight surfaces are damaged or uncontrollable. 

From these, the requirements for the propulsion system performance capabilities for a safe recovery 
and landing of an aircraft in adverse condition will be determined. In order to limit the study to a 
manageable set of cases, the airframes and engines will be limited to typical commercial aircraft 
configurations. The system level study will first identify the scenarios in which control of the damaged 
airframe is recoverable and the vehicle is able to maintain steady state flight. Once the survivability of the 
airframe in steady state is established, the next step is to identify the scenarios in which remaining 
dynamic resources are adequate for maneuvering and landing. Finally, for those scenarios in which the 
aircraft is structurally survivable, we will study the thrust level and throttle response needed to perform 
the maneuvers necessary to operate and land the damaged aircraft safely. This system study will produce 
a set of damage scenarios for which engine performance enhancement will be beneficial in a survivable 
landing. These results will also provide a guideline for the engine modeling and control research to 
achieve the performance enhancement requirements. 

III. Engine Modeling and Simulation 

In order to provide a platform for the intelligent propulsion control research, NASA Glenn Research 
Center is working with its industrial partners to develop a generic engine simulation package 
representative of a typical commercial turbofan engine. This development will also include a typical 
engine controller with protection logic to emulate engine control operations. This effort requires the 
collaboration of engine companies to provide engine performance characteristics and controller 
information. 

Currently available engine simulations are only calibrated using sea level static testing data. To aid in 
the validation of engine characteristics during flight, NASA and its industrial partner have proposed a task 
for flight data collection of engine performance characteristics. A specially instrumented engine will be 
used to collect engine performance data to calibrate the engine models. This engine model calibration will 
provide a better understanding of the engine operation for the performance variations at different 
operating conditions. The data collected in the flight test will also help in understanding trends in 
performance characteristics general to turbofan engines across and beyond the traditional operational 
envelope even though it is specific to one engine configuration. 

A generic engine controller has also been developed to mimic the functions of the Full Authority 
Digital Engine Control (FADEC) in engine operation. This includes all of the important protection logic 
affecting fan speed, core speed, fuel flow, temperatures, and pressures. This engine simulation will 
provide a starting platform for future developments to include other functionalities such as performance 
models, dynamic models, operability models, life usage models, and adaptive engine controls for flight 
integration. This engine simulation will also be incorporated as the basis for flight simulators at various 
NASA Centers to test the propulsion capability and the capability of the integrated flight and propulsion 
control under adverse conditions. 

Figure 2 shows the vision of the engine modeling development and maturation process. The baseline 
engine model will be developed first. Enhanced engine models will be updated continuously depending 
upon the on-going research findings in the engine performance, life models, and operability 
characteristics. The baseline engine operation simulation will be used in the early phase of the program to 


NAS A/TM— 2007-2 1 4940 


3 





Integrated 

C 9 Flight/Propulsion 
Control 


High Fidelity 
Flight Simulator 


Low Fidelity 
Flight Simulator 




Controller 

Design 


B K Operability 


Dynamics 



Figure 2. — Engine model maturation process. 

generate the high level requirements for engine enhancement. After new models are developed for 
performance dynamics and operability, an upgraded engine simulation model with control strategies will 
be tested using the flight simulators at NASA Centers to evaluate the engine performance. Damaged 
engine operation capability will be demonstrated by injecting different types of discrete damage 
(simulated by degrading various internal engine model parameters) and adjusting the control parameters 
to continue operation and recover desired thrust. 

The engine enhancement models will then be evaluated through a TOC study, since it does not 
require any software or hardware modifications to the flight simulator. This study will quantify the effects 
of enhanced engine performance on TOC over a set of damage scenarios. Based on this study, methods 
for creating and evaluating PCA control laws with an enhanced performance engine will be developed. 
The effects of both engine response enhancements (such as the relaxation of engine over-speed limits) 
and engine damage (such as restricted margins) on PCA performance will also be evaluated. This research 
will provide the foundation for the development and evaluation of a fully integrated flight/propulsion 
control system. 


IV. Engine Enhancement Research 

Previous experience on the PCA study shows that the engine response time has a major impact on the 
ability of the pilot to handle the aircraft for a safe landing. Also, although the engines usually have a very 
high thrust reserve during normal flight, this is not necessarily the case for a damaged aircraft. In the 
DAGE study, when a 757-like aircraft lost about 15 percent of the wing, it was demonstrated analytically 
that all the reserve thrust was required to keep the aircraft in steady state flight, and it would require more 
thrust to climb and maneuver the damaged aircraft. Thus, it is also necessary to explore overthrust 
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operation to provide the flight controller another option for maximizing the chance of a safe landing under 
adverse conditions. 

Research on engine dynamics will focus on the understanding and characterization of the transient 
engine response under various operating conditions. The flight data collection task mentioned in the 
Engine Modeling and Simulation section will also be used to estimate the engine dynamic response 
capability at various flight conditions. It can help provide understanding of the limitations as well as 
reveal opportunities for improving engine dynamic response. Engine performance research also includes 
Computational Fluid Dynamic (CFD) modeling for the stage by stage gas dynamics of engine operation 
in order to simulate engine transient characteristics for given operating conditions. This study will provide 
an important understanding about how to improve engine response time at key operating conditions such 
as during approach and landing (low power, low altitude). Other actuators such as bleed valves and guide 
vanes will also be examined for possible improvement of the dynamic response. Additionally, NASA will 
be working with industry partners on the development of a dynamic model under Numerical Propulsion 
System Simulation (NPSS). 

Models of engine operation beyond the normal flight envelope will also be developed. These studies 
will include accurate thrust representations at high inlet distortion conditions beyond the typical airplane 
upset condition. Engine operational characteristics beyond the design limits will also be studied in detail. 
This research result will provide a basis for the controller design for over-thrust engine operation. 

There will also be research on engine damage modeling for selected conditions such as foreign object 
damage (FOD), blade-out, and other damage scenarios. In order to provide possible continued operation 
of a damaged engine, this research will model the external damage that affects engine performance to 
simulate a slightly damaged but still operable engine. This study is based on a continuation of the 
previous NASA/GE CEDAR project under the Aviation Safety & Security Program. The CEDAR project 
has been a collaboration with both Wright Patterson Air Force Base (WPAFB) and NAVAIR. 

V. Operational Risk Analysis and Modeling 

The primary objective of this research is to understand and quantify the risk involved in enhanced 
engine operation for better performance. This includes the study of possible failure modes associated with 
the enhanced engine operation, life modeling of the critical components, and operability margin 
management. Because of the stochastic nature of the failures, it is also necessary to develop a quantitative 
representation tool to describe risks involved. 

The engine state plays an important role in how the engine operates. For example, a new engine will 
have much more thrust in reserve, be more responsive, and much less likely to fail when operated in an 
enhanced mode than an older engine. A “life meter” has been proposed to track the component life usage 
and to derive the likelihood of the failure on the next flight. This “life meter” would also be able perform 
a prognosis of the probability of failure for the intended enhanced operation. 

A system level failure mode analysis will be conducted for each control constraint in the engine 
controller and the likely failure modes that may impact engine operation will be identified. Life models 
associated with the critical components will be developed. Stochastic life models will be obtained using 
Monte Carlo simulations. Trade studies of engine performance, dynamics, operability constraints, and 
engine life consumption will be conducted. 

Another important engine parameter is the operability which includes the fan and compressor stability 
margins, inlet stability, and combustor stability. The operability study in this project will investigate the 
parameters and conditions that affect these stability margins. An on-line estimation capability will be 
developed. This is an important element for enhanced engine operation during the performance and safety 
trade-offs. NASA’s past research in the High Stability Engine Control (HISTEC) program provides some 
initial study on the stability management (ref. 7). 

An important research topic under this life-for-performance study is the understanding of different 
forms of risk. The risks involved here include different failure mechanisms with different severities for 
critical components, and the operability margins with different implied safety consequences. This 
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Figure 3. — Risk evaluation at engine level. 


description of risk will ultimately be communicated to the flight and mission levels for decision making 
on how to optimize the chance of safely recovering an aircraft from upset conditions. 

Figure 3 shows the information flow required for the risk management task in operating an engine in 
an enhanced mode. In figure 3, engine life usage is monitored to assess the condition of the engine. The 
engine health condition is used by the probability life prognosis module to evaluate the risk profile of 
control options selected by the flight controller. The engine state and risk information is then used by the 
flight controller in the high level decision making to maximize the chance for a successful recovery and 
landing under adverse conditions. 


VI. Integrated Flight and Propulsion Control 

The challenge of this research area is to develop a flexible control architecture that will be able to 
execute the aforementioned engine performance enhancing capabilities, which include thrust boost, faster 
response, and damaged engine operation. The designed controller shall also be able to seamlessly 
transition from normal operation to an emergency operating mode, and from one emergency mode to 
another emergency mode. 

In order to develop the control strategies for the engine enhancing capabilities, the limits implemented 
in the current controller will be studied to understand their impacts on performance when those limits are 
relaxed. A perturbation study of these control limits will provide the basis for an initial control strategy 
design for enhanced engine operation. These perturbation study results will also be used to investigate the 
component lifing issues associated with these operations. It is also important to understand and monitor 
the operability margins when engines are flown with the modified control requirements, especially when 
trying to improve the responsiveness of the engine. 
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Another area of control study is the manipulation of control actuators that are usually scheduled 
during the flight. These actuators include variable stator vanes, bleed valves at different stages, custom 
bleed valves, and the Active Clearance Control (ACC). It is important to study all possible options in the 
emergency operation of engine because the priority changes with the safety and performance 
considerations. 

One of the important functions of the adaptive engine control is the thrust management for integrated 
flight/propulsion control. The thrust management function lets the engine controller play an active role in 
flight control. This can include receiving direct commands from the flight controller for differential thrust 
to utilize the engine pair as a redundant set of flight actuators. The thrust management will also include 
the life/performance trade-off evaluation and optimization for the constraints specified by the flight 
controller. 


VII. Summary 

In this paper we have laid out a road map for a new propulsion research area for the IRAC project 
under NASA Aviation Safety Program. The goal of the IRAC project is to improve the likelihood of safe 
landing of a damaged airplane, and the propulsion element supports that goal by enabling the engines to 
act as responsive flight control actuators. This area includes fundamental research on how to improve the 
engine thrust response and thrust level performance for an emergency operation in order to achieve safe 
landing of an aircraft under adverse conditions. The paper also discussed the research needed to develop 
an understanding of the operational risks involved when the engine is operated beyond its normal limits. 
The risks involved include the component failures and operability margins. The control design is also 
critical for a successful implementation of the integrated flight and propulsion control. The IRAC project 
is a five year project that requires the close collaboration of government, industry, and academia in both 
fundamental and applied research. 
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